CVE-2026-27540

The repository claims to be a PoC for CVE-2026-27540, an unauthenticated arbitrary file upload vulnerability in WooCommerce Wholesale Lead Capture, but lacks actual exploit code. Instead, it directs users to a Telegram handle for the script, which is a common social engineering tactic.

The repository contains a functional Python exploit for CVE-2026-27540, targeting an unauthenticated arbitrary file upload vulnerability in WordPress. The script includes methods for session handling, brute-forcing upload directories, and privilege escalation checks.